CVE-2026-123875

Node.js versions 26.x, 24.x, and 22.x are vulnerable to a NULL pointer dereference within the HTTP/2 implementation. The flaw occurs when a client cancels a request for a file being served via stream.respondWithFile() or stream.respondWithFD() . This cancellation causes a StreamPipe to be torn do...